Platform Configuration Registers (PCRs) are memory locations inside a trusted platform module (TPM) that are used to store hashes of data. The TPM memory used for the PCRs may be volatile or non-volatile in nature.
Conventional Trusted Computing Group (TCG) specifications permit Read, Extend and Quote operations on the PCRs, which are performed by the TPM. The Read operation is used to read the value of a given PCR. The Extend operation is used to modify the value of the PCRs by extending the old contents with the new contents. This allows a challenger to see how the final PCR digests were built. The Quote operation is used for integrity reporting where the values of the PCR are encrypted using an attestation identification key (AIK) by the TPM. Attestation in this context refers to an activity of the platform to supply a measure of the trustworthiness of the system to internal or external challengers or requesters of such information. Integrity reporting may be used to determine a platform's current configuration.
When the TPM performs operations to generate integrity metrics, to be later used for verification of the integrity of a piece of code or data that is hashed, the TPM does not simply compute the hash of the most recent value of the target data or code and then input that value to a PCR. Instead, the TPM performs an Extend operation by concatenating the current existing value of the PCR with a new value of a system component to be measured, and performing a secure hash algorithm (SHA) on the concatenated data, and inputs the result in to the target PCR.
Each time a PCR is extended, a log entry is also made in the TCG event log. A TCG event log, also called a stored measurement log (SML), is a log of events that take place on the platform in which a TPM resides. An SML is a log of measured values of a component, (e.g., a piece of code), in a system platform that includes a TPM. The TPM performs a measurement of events, (such as the loading of a particular application software (SW)), that take place in the platform in which the TPM resides. The measurement kernel, which is a trusted part of the platform operating system (OS) that controls the TPM, generates measurement events upon request by the OS. Note that a “measurement event” is not the event that takes place in the platform itself, but rather a term that signifies the activity or event of the “measurement” performed for an event that occur in the platform. An example of such a platform-event would be the reading, into system memory, of a piece of software code. A measurement event consists of two classes of data: 1) measured values—a representation of embedded data or program code; and 2) measurement digests—a SHA hash of those values. Data are scanned by the TPM which generates a message digest. Digests are a snapshot of the machines' operational state. The two data elements, (measured values and measurement digest), are stored separately. The measurement digest is stored in PCRs in the TPM. The measured values may be stored virtually anywhere, typically in an SML, but they have to be stored in an encrypted fashion. In fact, the measured values may not be stored at all, but re-computed whenever the serialized representation is needed. Measurement data describe properties and characteristics of the measured component. The SML contains sequences of related measured values. Each sequence shares a common measurement digest. Measured values are appended to the common measurement digest and re-hashed. This is more commonly referred to as extending the digest. Extending ensures related measured values will not be ignored, and that the order of operations is preserved.
Algebraically, updates to an n-th PCR, at any time t+1, follows as:PCR[n](t+1)=SHA-1(PCR[n](t)+measured data(t+1))  Equation (1)PCR values are temporal and are reset at system reboot. Verification of measurement events requires the re-creation of the measurement digest and a simple comparison of the digest values, (using the PCR value as one of the comparators). TCG does not define data encoding rules for SML contents, but recommends following appropriate standards such as Extensible Markup Language (XML) to ensure broad accessibility.
FIG. 1 shows a conventional TCG attestation procedure, (i.e., protocol), implemented by a system 100 including a challenger 105, a platform agent 110, a TPM 115 and a repository 120.
The challenger 105 requests one or more PCR values from the platform agent 110 (step 125). The platform agent 110 collects SML entries, which are integrity measurement values (step 130). The platform agent 110 requests PCR values from the TPM 115 (step 135). The PCR values are measurement digests of the integrity measurement values, (i.e., signed hash of the integrity measurement values). The TPM 115 signs the PCR values using an AIK (step 140), and sends the signed PCR values to the platform agent 110 (step 145). The platform agent 110 also collects credentials that vouch for the TPM 115 from the repository 120 (steps 150, 155). The platform agent 110 sends the signed PCR values, the SML entries and the credentials to the challenger 105 (step 160). The challenger 105 then verifies the platform configuration (step 165). For the verification, the challenger 105 computes a measurement digest from the received SML entries and compares the computed measurement digest with the PCR values. The challenger 105 also evaluates the platform credentials and checks signatures.
The PCR values are extended every time a new measurement is made, and this information is logged by the TPM 115. This extending ensures that the order of measurements is preserved and that all the measurement values are taken into account. One of the challenges associated with extending the PCR values is that the state of a platform changes when any measurement is performed, so the state of the system might not be accurate if an application that is not relevant to the current application extends the PCRs.
Currently there is no standardized assignment of PCRs to applications other than the PCRs reserved for the boot up process. This can cause situations where more than one application is using the same PCR which is problematic for the reasons outlined below.
For example, if a trusted browser application is loaded before a trusted digital rights management (DRM) application, the state of the system as needed by the DRM application may not match the expected state if both applications make use of the same PCRs. This could potentially result in a failure to load the application as the state of the system is not what it is supposed to be. The challenger for the DRM application will also get information that the browser is running. This compromises the privacy of the user.
For example, FIG. 2 shows a conventional TCG procedure implemented by a system 200 including a first challenger 205, a second challenger 210 and a user device 215 including a platform agent 220 and a TPM 225, whereby different applications extend a PCR from different states, unaware of each other's extend operation. If the first challenger 205 requests the same changes to the PCR values that the second challenger 210 requests, the verification of the platform configuration by the second challenger 210 is going to fail even if the configuration of the platform is valid.
Referring to FIG. 2, the first challenger 205 sends a request for the platform configuration from the platform agent 220 (step 230), which then extends a PCR on the resident TPM 225 (step 235) and then requests for the signed value of the PCR from the TPM 225 (step 240), which sends back a signed PCR value, (signed by the TPM 225 with an AIK), back to the platform agent 220 (step 245). The first challenger 205 then receives the platform configuration from the platform agent 220 (step 250). Note that in this process (step 250) the first challenger 205 would normally also receive the signed PCR value and an SML entry, (neither of which are shown in FIG. 2), and use the platform configuration data, the signed PCR values, and the SML entry that are received, to verify the platform configuration (step 255).
Separately, the second challenger 210 could request (step 260) and later receive (step 280) the platform configuration from the platform agent 220, which extends the same PCR (step 265) in the TPM 225, and requests (step 270) and then receives (step 275) signed values of the PCR from the TPM 225. The second challenger 210 then could verify the platform configuration (step 285) that it received. The first challenger 205 and the second challenger 210 may be unaware of each other, and since the current TCG specifications do not specify a systematic method to assign which PCRs can be used to record the measurement digests that are appropriate and useful for different challengers in a secure and privacy-protective way, the same PCR may be used to record the measurement digests for both of these unrelated challengers. This creates a problem where the second challenger 210 may not necessarily be aware of the system state as represented by the PCR values that are extended with the measurements intended for the first challenger 205. Thus, in the point of view of the second challenger 210, unless it already tracks the fact that the same PCR has been extended because of the measurement and verification for first challenger 205, the second challenger 210 may compare wrong sets of data in its verification process because it may not receive all of the SMLs that are required to recreate the order of the PCR extension that took place before its own verification of the PCR. Alternatively, because such SMLs may become too big after many iterations of the PCR extension, the second challenger 210 may simply run out of processing capability to process of all of the previous SML entries to recreate the most recent previous state of the PCR.
The TCG procedure of FIG. 2 can also create leakages of private information that may be allowed to be disclosed to one challenger but not to others. Also the current procedures can create unwarranted verification, (when verification should not happen), or an unintended decision of non-verification, (when verification should happen), may occur on the challengers' sides. Currently, this problem is addressed by using one or more of the following approaches:
Reserving PCRs: As the state of the system is represented using the PCRs, certain PCRs can be assigned to certain applications. The disadvantage with this approach is that the number of PCRs in the TPM is usually around 16, (the TCG standard does not limit the number of PCRs), based on the cost and size considerations. This limits the ability to assign fixed PCRs to each application type.
Using PCR Event Log: Any changes to the PCR values are logged by the TPM. This log can be used along with the PCR values to see if the system is in correct state. However, the problem with this approach is that the log might contain information that is not directly relevant to the application in question and hence can compromise the user privacy.
Loading all applications during startup in a predetermined order also eliminates this problem. However, the startup times will be longer as all the applications have to be verified and loaded during startup making this approach non-practical to use.
These approaches have serious limitations, either in terms of limiting the functionality of the trusted platform or in terms of loss of privacy of the user.